Add an out parameter to VerifyCertificateChain for retrieving the trusted chain.

net/cert/internal/verify_certificate_chain_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include "base/base_paths.h"
 #include "base/files/file_util.h"
 #include "base/path_service.h"
 #include "base/strings/string_split.h"
@@ skipping 96 matching lines @@
 
   std::vector<scoped_refptr<net::ParsedCertificate>> input_chain;
   for (const auto& cert_der : chain) {
     ASSERT_TRUE(net::ParsedCertificate::CreateAndAddToVector(
         reinterpret_cast<const uint8_t*>(cert_der.data()), cert_der.size(),
         net::ParsedCertificate::DataSource::EXTERNAL_REFERENCE, &input_chain));
   }
 
   SimpleSignaturePolicy signature_policy(1024);
 
-  bool result =
-      VerifyCertificateChain(input_chain, trust_store, &signature_policy, time);
+  std::vector<scoped_refptr<ParsedCertificate>> trusted_chain;
+  bool result = VerifyCertificateChain(input_chain, trust_store,
+                                       &signature_policy, time, &trusted_chain);
+  if (result) {
+    ASSERT_EQ(trusted_chain.size(), input_chain.size() + 1);

[eroman, 2016/06/16 22:55:01]

This is true for most if not all the tests.
I guess run the tests and see if this works :)

It is possible we also have a test where the input chain contained the trust
anchor -- I don't remember if I added that as part of these unit tests or
elsewhere...

If that is the case you may need to relax this to allow for both possibilities.

[ryanchung, 2016/06/16 23:13:09]

All tests passed locally. Will let try bot confirm.

+    ASSERT_TRUE(std::equal(input_chain.begin(),
+                           input_chain.begin() + input_chain.size(),

[eroman, 2016/06/16 22:55:01]

nit: input_chain.end()

[ryanchung, 2016/06/16 23:13:09]

Done.

+                           trusted_chain.begin()));
+    ASSERT_TRUE(trust_store.IsTrustedCertificate(trusted_chain.back().get()));
+  } else {
+    ASSERT_EQ(trusted_chain.size(), 0u);
+  }
 
   ASSERT_EQ(expected_result, result);
 }
 
 TEST(VerifyCertificateChainTest, TargetAndIntermediary) {
   RunTest("target-and-intermediary.pem");
 }
 
 TEST(VerifyCertificateChainTest, UnknownRoot) {
   RunTest("unknown-root.pem");
@@ skipping 99 matching lines @@
   RunTest("non-self-signed-root.pem");
 }
 
 // Tests that verifying a chain with no certificates fails.
 TEST(VerifyCertificateChainTest, EmptyChainIsInvalid) {
   TrustStore trust_store;
   der::GeneralizedTime time;
   std::vector<scoped_refptr<ParsedCertificate>> chain;
   SimpleSignaturePolicy signature_policy(2048);
 
-  ASSERT_FALSE(
-      VerifyCertificateChain(chain, trust_store, &signature_policy, time));
+  ASSERT_FALSE(VerifyCertificateChain(chain, trust_store, &signature_policy,
+                                      time, nullptr));
 }
 
 // TODO(eroman): Add test that invalidate validity dates where the day or month
 // ordinal not in range, like "March 39, 2016" are rejected.
 
 }  // namespace
 
 }  // namespace net